基于数据挖掘和蜜罐的新型入侵检测系统研究

摘要

This paper researches a new intrusion detection system based on data mining and honeypot technology.Gives a brief introduction to the concept and the advantages and disadvantages of intrusion detection systems and honeypots technology,and complementary nature of intrusion detection systems and honeypots.Then gives the program to be a combination of them,analysis the model,and put data mining technology into it,to constitute a new type of intrusion detection system.The system improves the protection of resources and analysis capabilities of attack data in honeypot system,enhanced intrusion detection system protection capability.%文中对基于数据挖掘和蜜罐技术的新型入侵检测系统进行了研究。简单介绍了入侵检测系统和蜜罐技术的概念及优缺点,及入侵检测系统和蜜罐系统的互补性。进而提出将其两者相结合的方案,分析其模型,并将数据挖掘技术融入其中,构成新型的入侵检测系统。该系统提高了蜜罐系统对资源的保护及对攻击数据的分析能力,有效的增强了入侵检测系统的防护能力。